Module egress 

Upstream egress guard (SSRF mitigation, #1012 / MF-002). Upstream egress guard (SSRF mitigation, #1012 / MF-002).

The browser/mobile proxy strips a configurable prefix (default /proxy/) from request paths; anything that remains and parses as an absolute http(s):// URL used to be forwarded verbatim to an attacker-controlled host (CWE-918). This module provides the second layer of defense for URLs that are allowed through (explicit opt-in):

• denylisted IP ranges (loopback, RFC1918, link-local 169.254.0.0/16, cloud-metadata endpoints, IPv4-mapped IPv6 equivalents, ::1, unique-local and link-local IPv6),
• denylisted cloud-metadata hostnames,
• DNS resolution before connecting, so a hostname that rebinding attacks point at private space is caught before any socket is opened.

The guard applies only to URLs derived from the request path (attacker-controlled). Operator-configured upstreams (target_url, rule targets) are trusted configuration and are not re-checked.

Structs

EgressGuard

Egress guard over request-derived upstream URLs.

UpstreamAllowlist

Optional explicit allowlist for upstreams. When present it overrides the egress denylist: a URL matching one of these prefixes/hosts is proxied even if it would otherwise be blocked.

Enums

EgressDecision

Result of a pre-flight check on an upstream URL.

EgressError

Why an upstream URL was refused.

Functions

is_blocked_ip

True when the address is in a range the proxy must never dial.